Hernandez, Christina Marie R.

Information Assurance and Security

BSIT – 321

02 Task Performance 1

1. Pick one (1) social-media, app, or another popular service.

 TWITTER

a. What data is collected by the company?

The data that are being collected is depends on how the users shared their data
to the company. The application requires a verified phone number and email
address, as well as a detailed description of how the API will be used. Use of the
Twitter API requires agreeing to Twitter’s Developer Agreement and Policy, as
well as their related policies, and this includes the requirements on display.
These agreements are in place to ensure a reasonable usage of the Twitter API
and the data shared. Once a developer account has been established, a
developer’s Twitter application needs to be registered by providing a name,
description, and domain. This application authenticates the end user for the
application of the Twitter API and gives the user the necessary access key and
access token through the app management dashboard.

An also Twitter can collect data of users by just looking at tweets, they receive
some personal information from them like the type of device they are using and
their IP address. They can choose to share additional information with the
company like their email address, phone number, address book contacts, and a
public profile.

b. What your data can be used for?

With the data I shared with Twitter, they can easily identify my preferences based
on the content I posted, liked, and retweeted. And for the other information I
input in their application, they can determine and suggest topics that I am
interested in, topics that I can relate in based on my age and the language that
Hernandez, Christina Marie R. Information Assurance and Security
BSIT – 321
we speak with and other signals to show us more relevant content. They can give
us transparency into that data and can modify or correct it at any time.

They can give us control through our settings to limit the data that they collect
from us and how they use it, and to control things like account security,
marketing preferences, apps that can access your account, and address book
contacts we have uploaded to Twitter. We can also download information we
have shared on Twitter.

c. Who they share your data with?

The data is being shared on the account of the users and who they interact with
on Twitter. Twitter is public and Tweets are immediately viewable and searchable
by anyone around the world. But they can also give users a non-public way to
communicate on Twitter too. They can control this by going through protected
Tweets and Direct Messages.

d. What those third parties use data for?

Third-party apps are applications built on the Twitter platform by external
developers and are not owned or operated by Twitter. When you connect a third-
party app to your Twitter account, you are granting that app access to use your
account. Depending on its permissions, an authorized app may be able to obtain
information from and use your account in various ways, such as reading your
Tweets, seeing who you follow, updating your profile, posting Tweets on your
behalf, accessing your Direct Messages, or seeing your email address.
Hernandez, Christina Marie R. Information Assurance and Security
BSIT – 321
2. Based on your observation, what are the rooms for improvement that you can suggest
in their privacy policies?

Based on my observation, they have improved their protection on user’s accounts

and also between the third-party unlike the past years of their policies. When Twitter
receives information about the users, they use that information to improve their
services, to personalize the Twitter experience, and for other purposes as described
in their Privacy Policy. In some cases, this involves sharing non-public personal
information with partners. While I was reading their recent privacy policies, twitter’s
security for data is good as of now but it is not that strong as expected to be. Since
they are one of the most popular social media platforms, they should be focusing on
securing large data and user accounts. If I am going to recommend improvements in
their privacy policies, I would suggest a face verification ID. So that the account user
can not just easily verify as real account and not consider them as bots but also to
secure their account as well. I have seen users complaining how their policies
suspending their accounts because they were mistakenly as spam accounts. For me,
they should apply this feature as verification in order to protect the user accounts.